beehivesec/prysm-agent repository overview

beehivesec/prysm-ebpf-collector

Prysm eBPF collector: runs on a node with access to the kernel, collects kernel-level security events via eBPF, and forwards them to the Prysm log ingestion endpoint. Used for host/security telemetry (e.g. syscalls, process/network events).

⁠Image

• Docker Hub: beehivesec/prysm-ebpf-collector
• Tags: latest, or set EBPF_IMAGE_TAG (e.g. v1.0.0)

⁠Pull

docker pull beehivesec/prysm-ebpf-collector:latest

⁠Required environment variables

⁠Optional environment variables

⁠Runtime requirements

• Privileged or capabilities: SYS_ADMIN, SYS_PTRACE, NET_ADMIN, BPF.
• Host mounts (for eBPF): /sys/fs/bpf, /lib/modules, /sys/kernel/tracing, /sys/kernel/debug; optionally /usr/src.
• Typically run as root (user: "0:0") when using host kernel interfaces.

⁠Usage

⁠Docker Compose

With host mounts and ingest URL:

ebpf-collector:
  image: beehivesec/prysm-ebpf-collector:latest
  user: "0:0"
  privileged: true
  cap_add:
    - SYS_ADMIN
    - SYS_PTRACE
    - NET_ADMIN
    - BPF
  volumes:
    - /sys/fs/bpf:/sys/fs/bpf
    - /lib/modules:/lib/modules:ro
    - /sys/kernel/tracing:/sys/kernel/tracing
    - /sys/kernel/debug:/sys/kernel/debug
  environment:
    PRYSM_ORG_ID: "1"
    PRYSM_SINK_ID: "1"
    PRYSM_EBPF_ENDPOINT: http://log-ingestion-service:8090/api/v1/logs/ingest
    PRYSM_CLUSTER_ID: "1"
    PRYSM_SKIP_SIGNATURE_VERIFICATION: "true"
  depends_on:
    - log-ingestion-service

⁠Kubernetes (DaemonSet)

Deploy as a DaemonSet so one collector runs per node. Use the Prysm agent chart⁠ with eBPF enabled, or the observability manifest; image is set via:

• ebpf.image.repository: beehivesec/prysm-ebpf-collector
• ebpf.image.tag: latest (or your tag)

Bootstrap scripts use EBPF_IMAGE_REPOSITORY and EBPF_IMAGE_TAG.

⁠Build from source

From the repo root:

docker build -f ebpf-collector/Dockerfile -t beehivesec/prysm-ebpf-collector:latest ./ebpf-collector

Note: The distroless image runs as nonroot by default; for eBPF you typically override to root and use privileged/host mounts when running in Compose or K8s.

⁠Security

• Runs with elevated privileges to load eBPF programs and read kernel interfaces.
• For production, use a dedicated token and avoid PRYSM_SKIP_SIGNATURE_VERIFICATION=true unless required.
• See ebpf-collector/SECURITY-HARDENING.md in the repo for hardening guidance.

⁠License

See repository LICENSE.